[TLS] Ticket caching (was Re: tickets or sesssions or both (oh my))

[Martin Thomson <[e-mail]>]

On 3 September 2014 13:12, Karthikeyan Bhargavan
<[e-mail]> wrote:
> The question is what is the identity of S that C should use when storing the ticket?
> Can we give some recommendations?

The only basis we really have is the identity that was originally
sought.  We still want to permit different certificates (if not
different names), so knowing identity prior to committing the first
flight is of marginal utility anyway.

If an attacker can masquerade as a valid origin, then I don't think
that we should be specifically concerned that it can produce tickets
that cause it to access information.

It's trivial to force that first flight to go anywhere, but you have
to be able to decrypt it to gain any real advantage.  The attack you
describe requires one of a range of breaks: forcing identical master
secrets, decrypting the session (not just finding a collision in the
MAC), or breaking the previous session.